EUVD-2026-59591
GHSA-g4x6-qr8w-c3x7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
S:C chosen over S:U because exploitation explicitly crosses site authorization boundaries within the multisite network; PR:H confirmed as sub-site admin access is a hard prerequisite.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
AnalysisAI
Cross-site privilege escalation in the Backup Migration WordPress plugin (versions before 2.1.7) exposes WordPress multisite networks to unauthorized administrative access. A sub-site administrator can exploit an improperly restricted post-restore automatic login mechanism to obtain a persistent, long-lived authenticated session as an administrator of a separate site within the same network - without supplying credentials and bypassing any two-factor authentication controls in place on the target site. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), indicating low current exploitation probability despite the high confidentiality and integrity impact.
Technical ContextAI
WordPress multisite is a network architecture that allows a single WordPress installation to host multiple distinct sites under one codebase. The Backup Migration plugin (affected versions: all releases from 0 up to but not including 2.1.7, per EUVD-2026-59591) implements a post-restore automatic login mechanism designed to re-authenticate an administrator after a site restore completes. Due to CWE-287 (Improper Authentication), this mechanism fails to enforce site-scoped authorization boundaries, allowing a session or login callback generated during the restore flow of Site A to be used to authenticate as an administrator on Site B within the same network. The bypass of 2FA is a compounding factor: even if the target site's admin accounts have 2FA enrolled, the automatic login mechanism circumvents that control entirely, undermining a common compensating defense.
RemediationAI
Update the Backup Migration WordPress plugin to version 2.1.7 or later, which is confirmed as the patched release per the vendor advisory referenced in the WPScan report (https://wpscan.com/vulnerability/f12530c5-4069-42c2-9f1c-b00fc62aa387/). If immediate patching is not feasible, a targeted compensating control is to restrict restore operation permissions so that only fully trusted network-level super-admins can execute restores - this removes the attack surface by preventing untrusted sub-site admins from triggering the vulnerable post-restore login mechanism, though it does not fix the underlying flaw and requires manual access-control enforcement. Disabling the Backup Migration plugin entirely until patching is possible is the most conservative interim option, with the trade-off of losing automated backup-and-restore functionality for the network. Do not treat 2FA as a mitigating control for this specific vulnerability, as the flaw explicitly bypasses it.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today